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Description 

Field of the invention 

s [0001] This invention relates to a method of authenticating digital data works, particularly to enable any unauthorised 
alterations to that work to be rendered readily detectable. 

Description of the Prior Art 

10 [0002] Systems based upon digital data are becoming universal and indispensable; digital data passing between 
computers; digital telecommunications; digital audio; digital cameras; and the convergence of many of these individual 
components into multi-media, are a selection of the technologies to which this invention relates. 
[0003] There are many applications for a technique that can enable any unauthorised alterations to that work to be 
rendered readily detectable. For example, it is today very easy to tamper with a digital photograph, rendering the 

is authenticity of any digital photograph questionable. That will have serious implications for the use of digital photographic 
evidence in criminal litigation, for example. It may therefore be advantageous to be able to assert that the integrity of 
any given digital photograph can be assured. Similarly, it is becoming common to archive documents, including legal 
contracts and financial instruments, by imaging and storage on non-erasable digital media, such as WORM. There is 
a pressing need to ensure that those digital records are tamper evident. There are similar issues pertaining to digital 

20 audio and video. For example, where digitally recorded speech is to be used in evidence, typically to confirm the 
existence and terms of an oral agreement, then validation of the integrity of the recording is particularly helpful. 
[0004] There are various established approaches to ensuring data integrity in the telecommunications and digital 
audio field; for example, the use of error correction techniques relying upon check-sums. However, these techniques 
are designed to ensure that a digital signal generated by a device, for example, a CD player, is an accurate transmission 

25 or reproduction from a source, for example the data stored within the CD. That is different from being able to detect if, 
without access to the original CD, any duplicate made of the CD is a completely accurate reproduction of the original CD. 
[0005] The present invention is directed to solving this latter problem. Hence, the present invention is not directed 
to manipulating small units of digital data to enable that data to carry information inherent to the proper comprehension 
of the digital data itself but instead to modifying various sub-sets within a digital data work in such a way that any 

30 subsequent unauthorised modification or alteration to any of those sub-sets is readily detectable. 

[0006] Currently, it is possible to include a simple identifier in the header of the data file of a digital data work. The 
header might typically comprise a checksum derived from the contents of the data file so that any alteration of the 
contents inevitably leads to a mismatch with the checksum; the mismatch can readily be detected, enabling the alter- 
ation to be detected. However, it can be relatively easy to strip out the header checksum entirely, in which case one 

35 could not establish the integrity of the data. 

[0007] EP-A-0 402 210 suggests a method of authenticating a digital data work by dividing the digital data work into 
blocks. For each block, a signature is derived using an algorithm. The signatures are stored in a portable object. When 
the digital data work is opened its signature is derived using the same algorithm. If the data have been altered, the 
application of said algorithm results in a different signature. 

40 

Statement of the invention 

[0008] In accordance with the present invention, a method of authenticating a digital data work, to enable any un- 
authorised alteration to that work to be readily detectable, comprises the steps of dividing the whole or part of the work 

45 into sets of data elements with each data element or set of data elements having a measurable characteristic, selecting 
a particular set of data elements and then modifying a pre-determined sub-set of the data elements in that set so that 
the measurable characteristic of that pre-determined sub-set, or the data elements in that sub-set, satisfies a prede- 
termined relation, the measurable characteristic of any sub-set, or the data elements in that sub-set, being measurably 
changed if any data element of that sub-set is altered. 

so [0009] Hence, the essence of the invention is to enable the integrity or authenticity of a digital data work to be es- 
tablished by changing the digital data work according to a particular algorithm so that some or all of its constituent 
parts possess a measurable characteristic; that measurable characteristic is changed if any alterations to the digital 
data work are subsequently carried out. That change can then be detected using a detection process. 
[0010] By way of example, if the digital data work is a rectangular photographic image, that work might be subdivided 

55 into smaller rectangles; for a particular such smaller rectangle, a sub-set of the data elements making up that smaller 
rectangle could be selected according to a rule derived from a private key. Some of these selected elements might 
then be modified so that a particular relationship is satisfied by them; for instance, that the sum of their values [where 
relevant] is a multiple of 7. The same rectangle could then be divided into a different set of elements which may or may 



2 



EP 0 838 050 B1 



not overlap the first set. Some of the values of the data elements might then be modified to satisfy a further relationship. 
However, where this is the case, and the two sets of elements within the same rectangle overlap, then the further 
modification must preserve the first relationship. Every element of each small rectangle should preferably form part of 
at least one set of data elements. In a preferred embodiment, every element of each small rectangle must form part 

5 of at least one set of data elements. This ensures that no pixel can escape checking. The process of modification 
according to a particular rule is carried out on preferably all the rectangles into which the image is divided. 
[0011] More generally, the digital data work may be divided into convenient sets of data elements, the members of 
which may then be modified according to a required algorithm. In the case of audio data, for example, the digital signals 
may be split into sets of amplitude signal levels of any suitable length. These sets of data elements can then be sub- 

10 divided into individual data elements, with a subsequent modification to those individual data elements as described 
above. 

[0012] It is important that the method of sub-division, i.e. selection of the actual data elements in a particular set of 
data elements to be modified, is private, as should the relationships to be obeyed by the modified data elements. 
Commonly, each will be known only to the originator of the digital data work, or alternatively some person unconnected 

is in any way with the work itself. For example, in the case of photographic equipment designed to produce photographs 
for evidential purposes, e.g. security cameras, it may be only the manufacturer of the equipment who knows the method 
of sub-division and the relationships obeyed by the modified data elements. Either or both of the method of subdivision 
and the relationships obeyed by the modified data elements may preferably be derivable from a key selected by the 
manufacturer or originator. It will then be highly improbable that anyone might by chance modify the digital data work 

20 in a way that results in various data elements satisfying the predetermined relationship. Further, the key could also be 
formed from two different constituent keys, each constituent key being held by a different party. Only when both parties 
co-operate can a validation process then be performed. 

Detailed Description 

25 

[0013] The detailed description that follows is in respect of an embodiment of the invention that relates to digitised 
images. 

[0014] For the sake of simplicity, it is supposed that the image concerned is rectangular and sub-divided into sets of 
smaller rectangles, r 1f r 2 , r 3 r n . The only theoretical restriction on the sub-divisions is that they should divide the 

30 data in a rep eatable way, as in a tessellation. 

[0015] Suppose that each rectangle, r v contains m members r^, r 12 , r 13 , r 1m . Each of these members has one 

or more measurable characteristics. In the case of contone images these would usually be numbers between 0 and 
255, that is numbers requiring 8 bits of binary data to represent them. These numbers correspond roughly to the 
intensity of colours in the element. Again, for the sake of simplicity, it will be assumed that the only one such number 

35 js present for each element and that this describes a position on a greyscale, that is an indication of how nearly black 
or white an element is. 

[0016] Anyone wishing to ensure the integrity of the data would select a key which typically could be a number 
between 0 and 100,000,000. This key would be known only to the originator. This key is used to derive an algorithm 
which is used as described below. 
40 [0017] First, a choice is made of the size of the rectangles r v r 2 , r 3 , ....r n . For a given rectangle, r,, a selection of the 
elements Sj, s 2 , s 3 , s n , is then made according to a scheme derived from the key These elements have corre- 
sponding values v 1f v 2 , v 3 , v n . 

[0018] An arithmetic relationship is derived from the key according to previously defined rules. This is a relationship 
which the values Vj must satisfy. The choice of type of relationship is considerable, ranging from primitive requirements, 
45 such as the sum of elements being even, or the sum of the individual bits of a binary representation of the numbers 
being a given multiple, through to complicated functional relationships. In order to satisfy these relationships, some or 
all of the values of v n must be adjusted. 

[0019] Two major considerations influence the choice of relationships. The first is that the probability of the data 
satisfying the relationship without any adjustment must be small. 
so [0020] Secondly, the adjustments required must not be large for any element and only a small proportion of values 
should need to be changed. This latter requirement is necessary to ensure that the data work suffers no significant 
loss of information. 

[0021] A second set of elements X v t 2 , t 3 t n . is chosen from the members of iy This set, as before, will be required 

to satisfy a set of relationships, with the same criteria for acceptability This process continues until every member of 
55 r, has appeared in at least one selected set. The simplest version of this process is, of course, the division of the 
rectangle into two non-intersecting sets. 

[0022] The process is now repeated for every one of the n rectangles, so that the values of every element of the 
image have been related to the values of some other elements. 
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[0023] The method of detection is virtually the inverse process. Detection can only take place if the originator's key 
is known, because that information is necessary to generate the appropriate sets and relationships. If part of an image 
has been tampered with in any way, the relationships on one or more of the rectangles r, will not be satisfied. If the 
image has been cropped it may be necessary for the detector to spend some time locating the correct origins of the 
5 rectangles ri, but there should be no doubt when the correct position has been discovered because, except in the case 
of gross distortion of the image, the relationship will be satisfied on the majority of the rectangles of the set. 
[0024] The nature of the method is unchanged if data is sequential, as in the case of audio data or video recordings. 
There will again be the division of data in a repetitive manner and adjustment to satisfy prescribed relationships. 

10 Further Illustrative Example 

[0025] There now follows a further detailed example of the present invention. For simplicity, the scale of the following 
example is smaller than would be used in actual situations. 

75 Stage 1 : Choice of Key 

[0026] Any user of an image validation scheme in accordance with this invention is provided with a key. The key is 
used to carry out the initial validation of the image and to check that no subsequent alterations have been made. In 
this further example, we assume that the chosen key, k, must be in the range 1 to 1 0000. From this key various numbers 
20 must be deduced for various parts of the validation process. The only real requirement is that, whatever method is 
used, each key will give its own unique validation process. As an example, a number k 8 , is required to govern the 
selection of a subset from a rectangular array which represents part of an image. If this number is required in the range 
0 to 49, an arbitrary prescription might be to permute the digits of the key in a predefined manner, divide the resulting 
number by 50 and take the remainder. The set of possible prescriptions is vast. 



25 
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Stage 2: Division of Rectangles 

[0027] The image array is divided into rectangles. In this illustration, these are 4x4 squares, r 1f r 2 , r 3 ,. 
Suppose that is the array indicated below: 



5 8 3 1 
4 9 6 6 
35 2 9 7 6 

7 2 7 2 

Stage 3: Selection of sub-sets 

40 

[0028] The array r 1 is sub-divided into sets s v s 2 , s 3 , s 4 . The method of subdivision consists of the following two steps. 
Step 1 : Choice of permutation 

45 [0029] Since there are 4 members to each of the sets s, we consider permutations of 4 objects. Given a set a,b,c, 
d, an arbitrarily chosen permutation of the set can be described by the notation: 



P = 1234 
3 142 



[0030] This is read as: "The element in position 1 moves to position 3: the element in position 2 moves to position 
1: etc." 

55 [0031] In the validation process, we need to derive such a permutation from a number k^ derived from the key, k. 
Each k Q must correspond to a unique permutation. As can be seen above, the essence of choosing a permutation is 
to select a rearrangement of the 4 numbers 1, 2, 3, 4. One simple method of choosing would be to write down and 
number all possible permutations of the numbers 1 to 4, and use k 8 to select which permutation is required. 
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Step 2: Application of Permutation 

[0032] Using the above permutation, P, and a fairly obvious notation, P (abed) = (bdac), P 2 is the notation used to 
indicate that the permutation P has been applied twice. The first application to (abed) gives (bdac) as above. The 
second application follows thus:- 

P2 (abed) = P(P(abcd)) = P(bdac) = (deba) 
Similarly, P 3 (abed) = (cadb) and P 4 (abed) = (abed) 

[0033] Concatenating (abed) and its permutations we obtain the ordered set:- (abcd)(bdac)(dcba)(cadb). 

[0034] Arranging each set of 4 into a 2x2 square we can arrange the permutations to match the rectangle r, thus: 

a b b d 
c d a c 
d c c a 
b a d b 



[0035] We can now take the set si to consist of those elements in positions marked with an 'a' and s 2 to consist of 
20 those sets marked with a 'b\ Thus s-, is the set in bold, underlined type in the first rectangle, below left, and s 2 the set 
in bold, underlined type in the second rectangle, below right. 

£ 8 3 1 sail 

25 4 9 £ 6 4966 

297$. 2976 
7 1 7 2 1 2 7 1 

30 

[0036] Similarly for s 3 and s 4 . 
Stage 4: Modifying Sets 

35 [0037] From the key k, a set of numbers k 1( k 2 , k 3 , k 4 must be derived for each of the sets s 2 , s 3 , s 4 in order to 
enable the validation procedure. 

[0038] Let us first consider the set s 1 and suppose that k-, = 3. The validation procedure requires an arithmetic 
relationship between members of s-,. Suppose that relationship is that the sum of the members of s 1 is to be a multiple 
of k 1 (i.e. 3 in this case). 
40 [0039] From the above s i = {5,6,6,2} 

[0040] Summing, we have 5 + 6 + 6+ 2=19, 

[0041] This is not a multiple of 3. The nearest multiple of 3 is 18. Tosatisfy the arithmetic relationship we must reduce 
the total by 1 . This will be achieved if we reduce the '5' to a '4'. 
[0042] Then s t = {4,6,6,2} and its sum is a multiple of 3 as required. 
45 [0043] As similar process is carried out with the set s 2 , the sum of the numbers being required to be a multiple of 
k 2 . Likewise with sets s 3 , s 4 ... 

[0044] The process is then repeated for each of the rectangles r 2 , r 3 ,... until the whole image has been modified. 
[0045] In practice the size of rectangle would be much greater giving far greater choice of sets s, and hence making 
trial and error methods of detection impossible. If for instance, a set of 8 elements is chosen from 32 elements the 
so number of possible selections is more than 10 million. Further, the elements to be diminished or increased may be 
chosen to spread evenly through the rectangle. 

Detection of Modifications to Validated Images 

55 [0046] If it is suspected that an image has been modified, anyone wishing to detect the modification must have 
knowledge of the key, k, which was used in the modification. 

[0047] The first stage is then to follow the first steps above. That is, the image must be divided into rectangles r 1t 
r 2 , r 3 , and from these, for each rectangle, selections s 1( s 2 , s 3 , s 4 , must be made, the choice being governed by 
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the key k. 

[0048] For the set the value of k-, must be derived from k and as in the case above, will have the value 3. 
[0049] The elements of Sj will be summed. If no alteration has been made then the sum will be 4 + 6+ 6 + 2=18 
as above. The fact that it is a multiple of 3 suggest that no alteration has been made. 
s [0050] If on the other hand, the '2' in s t had been changed to a '4', the summation above would become : 4 + 6 + 6 
+ 4 = 20. Since this is not a multiple of 3 it would be apparent that a modification of the image had occurred. 
[0051] The same process is carried out throughout the image. 

[0052] Clearly in this case there is a high risk that an altered image might by chance satisfy the arithmetic relationship. 
In real cases the size of rectangle is greater and the values of k v k 2 , k 3 .... will be greater. In a typical image 3 numbers 
10 might be required to describe a pixel so that even if there were to be a one in twenty chance of satisfying the relationship, 
there would only be a one in eight thousand chance of satisfying the relationship for a whole pixel. 



Claims 

15 

1. A method of authenticating a digital data work, to enable any unauthorised alteration to that work to be readily 
detectable, comprising the steps of: 

dividing the whole or part of the work into sets of data elements and respective sub-sets, with each data 
20 element or sub-set of data elements having a measurable characteristic; 

selecting a particular set of data elements and then modifying a pre-determined sub-set of data elements in 
that set so that the measurable characteristic of that pre-determined sub-set, or the data elements in that sub- 
set, satisfies a predetermined relation, the measurable characteristic of any sub-set, or the data elements in 
that sub-set, being measurably changed if any data element of that sub-set is altered. 

25 

2. The method of claim 1 comprising the further step of selecting each other set of data elements of the work and 
then modifying a pre-determined sub-set of data elements in each such set in the manner as defined in claim 1 . 

3. The method of claim 2 wherein the sub-sets of all the sets of data elements of the work together consist of all the 
30 data elements of the work. 

4. The method of claim 1 wherein the sub-set of data elements in each set is selected in accordance with an algorithm 
derivable from a secret key. 

35 5. The method of claim 1 wherein the modification of the data elements in each sub-set is in accordance with an 
algorithm derivable from a secret key such that the likelihood of the measurable characteristic arising by chance 
is very low. 

6. A method of detecting any alteration of a digital data work, to which the authentication method of claims 1 -5 has 
40 been applied, comprising the steps of: 

dividing the whole or part of the work into sets of data elements and respective sub-sets, with each data 
element or sub-set of data elements having a measurable characteristic; 

selecting each particular set of data elements and further selecting a pre-determined sub-set of data elements 
45 in each set; 

determining whether the measurable characteristic of that pre-determined sub-set, or the data elements in 
that sub-set, satisfies a predetermined relation, and issuing a signal if the measurable characteristic of any 
data element or sub-set does not satisfy that predetermined relation, that signal being indicative of the work 
having been altered. 

50 

7. A digital data work to which the authentication method of any of claims 1 -5 has been applied. 

8. A computer program operable to authenticate a digital data work comprising computer program code means adapt- 
ed to perform all the steps of the method defined in any of Claims 1 to 5. 

55 

9. A computer program operable to detect any alteration to a digital data work, to which the authentication method 
of claims 1 -5 has been applied, comprising computer program code means adapted to perform all the steps of the 
method defined in claim 6. 
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10. Digital media pre-recorded with a computer program as defined in either claim 8 or claim 9. 



Patentanspruche 

5 

1 . Verfahren zur Authentifizierung einer digitalen Datenarbeit, das es ermdglicht, unbef ugte Anderungen dieser Arbeit 
einfach erkennen zu konnen, einschlieGlich folgender Schritte: 

Unterteilung der gesamten Oder Teil der Arbeit in Datenelementsatze und entsprechende Datenelement-Un- 
10 tersatze, wobei jedes Datenelement Oder jeder Datenelement-Untersatz uber eine meGbare Eigenschaft ver- 

fugt; 

Auswahl eines speziellen Datenelementsatzes und anschlieGende Abanderung eines vorbestimmten Daten- 
element-Untersatzes in diesem Satz, so daG die meGbare Eigenschaft dieses vorbestimmten Untersatzes 
oder die Datenelemente in diesem Untersatz, eine vorbestimmte Beziehung befriedigen, wobei die meGbare 
is Eigenschaft eines jeden Untersatzes Oder der Datenelemente in diesem Untersatz, meGbarverandert werden, 

falls irgendein Datenelement diese Untersatzes geandert wird. 

2. Verfahren gemaG Anspruch 1 , einschlieGlich des weiteren Schrittes der Auswahl jedes zweiten Datenelementsat- 
zes der Arbeit und folglicher Abanderung eines vorbestimmten Datenelement-Untersatzes in jedem dieser Satze 

20 in der in Anspruch 1 beschriebenen Art und Weise. 

3. Verfahren gemaG Anspruch 2, wobei die Untersatze aus alien Datenelementsatzen der Arbeit zusammen aus alien 
Datenelementen der Arbeit bestehen. 

25 4. Verfahren gemaG Anspruch 1 , wobei die Datenelement-Untersatze in jedem Satz gemaG einem Algorithmus ge- 
wahlt werden, der aus einem geheimen Schlussel abgeleitet wird. 

5. Verfahren gemaG Anspruch 1 . wobei die Abanderung der Datenelemente in jedem Untersatz gemaG einem Algo- 
rithmus gewahlt wird, der aus einem geheimen Schlussel abgeleitet wird, so daG nur eine auGerst geringe Chance 

30 besteht, daG die meGbare Eigenschaft sich zufallig ergibt. 

6. Verfahren zur Erkennung jeglicher Abanderungen einer digitalen Datenarbeit bei der das Authentifizierungsver- 
fahren gemaG den Anspruchen 1-5 angewandt wurde, einschlieGlich der folgenden Schritte: 

35 Unterteilung der gesamten oder Teil der Arbeit in Datenelementsatze und entsprechende Datenelement-Un- 

tersatze, wobei jedes Datenelement oder jeder Datenelement-Untersatz uber eine meGbare Eigenschaft ver- 
fugt; 

Auswahl eines speziellen Datenelementsatzes und weitere Auswahl eines vorbestimmten Datenelement-Un- 
tersatzes in jedem Satz; 

40 Ermittlung, ob die meGbare Eigenschaft des vorbestimmten Untersatzes oder der Datenelemente in diesem 

Untersatz eine vorbestimmte Beziehung befriedigen und Ausgabe eines Signals, falls die meGbare Eigen- 
schaft irgendeines Datenelements oder Untersatzes die vorbestimmte Beziehung nicht befriedigt, wobei das 
Signal anzeigt, daG die Arbeit geandert wurde. 

45 7. Digitale Datenarbeit bei der das Authentifizierungsverfahren gemaG den Anspruchen 1 -5 angewandt wurde. 

8. Computerprogramm zur Authentifizierung einer digitalen Datenarbeit gemaG dem in Anspruchen 1 bis 5 definierten 
Verfahren. 

so 9. Computerprogramm zur Erkennung jeglicher Abanderung einer digitalen Datenarbeit bei der das Authentifizie- 
rungsverfahren gemaG den Anspruchen 1-5 angewandt wurde, bei Einsatz des in Anspruch 6 definierten Verfah- 
rens. 

10. Digitale Medien, die mit einem wie in Anspruch 8 und 9 definierten Computerprogramm vorab aufgenommen wur- 
55 den. 
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Revendlcatlons 

1. Une methode de validation d'un ouvrage comportant des donnees nunrteriques, pour permettre la detection facile 
de tout remaniement non autorise de cet ouvrage, comprenant les Stapes suivantes: 

5 

la division de la totality ou d'une partie de I'ouvrage en ensembles de donnees et sous-ensembles respectifs, 
chaque donn6e ou sous-ensemble de donnees ayant une caracteristique mesurable; 
la selection d'un ensemble particulier de donnees, puis la modification d'un sous-ensemble predetermine de 
donnees dans cet ensemble de facon a ce que la caracteristique mesurable de ce sous-ensemble ptedeter- 
10 mine, ou des donnees dans ce sous-ensemble, satisfasse un rapport predetermine, la caracteristique mesu- 

- rable de tout sous-ensemble, ou des donnees dans ce sous-ensemble, etant mesurablement changed si toute 
donn6e de ce sous-ensemble est remaniee. 

2. La methode de la revendication 1 comprenant I'etape supplemental de la selection de chaque autre ensemble 
is de donn6es de I'ouvrage, puis de la modification d'un sous-ensemble predetermine de donn6es dans chacun de 

ces ensembles de la maniere definie dans ia revendication 1. 

3. La methode de la revendication 2 dans quoi les sous-ensembles de tous les ensembles de donnees de I'ouvrage 
constituent ensemble toutes les donn6es de I'ouvrage. 

20 

4. La methode de la revendication 1 dans quoi le sous-ensemble de donnees dans chaque ensemble est selectionne 
confornrtement a un algorithme derivable d'une cie secrete. 

5. La methode de la revendication 1 dans quoi la modification des donn6es dans chaque sous-ensemble est conforme 
25 & un algorithme derivable d'une cle secrete de sorte qu'il est tres peu probable que la caracteristique mesurable 

se presente par hasard. 

6. Une methode de detection de tout remaniement d'un ouvrage comportant des donnees numeriques, auquel la 
nrtethode de validation des revendications t-5 a 6t6 appliqu6e, comprenant les Stapes suivantes: 

30 

la division de la totalite ou d'une partie de I'ouvrage en ensembles de donnees et sous-ensembles respectifs, 
chaque donn6e ou sous-ensemble de donnees ayant une caracteristique mesurable; 
la selection de chaque ensemble particulier de donnees, et la selection supplemental d'un sous-ensemble 
de donnees predetermine dans chaque ensemble; 
35 la determination si la caracteristique mesurable de ce sous-ensemble predetermine, ou des donnees dans ce 

sous-ensemble, satisfait un rapport predetermine, et remission d'un signal si la caracteristique mesurable de 
toute donn6e ou sous-ensemble ne satisfait pas ce rapport predetermine, ce signal indiquant que I'ouvrage 
a ete remanie. 

40 7. Un ouvrage comportant des donnSes nunteriques auquel la nrtethode de validation de I'une quelconque des re- 
vendications 1-5 a ete appliquSe. 

8. Un programme informatique utilisable pour valider un ouvrage comportant des donnees numeriques a I'aide de la 
methode definie dans I'une quelconque des revendications 1 a 5. 

45 

9. Un programme informatique utilisable pour detecter tout remaniement d'un ouvrage comportant des donnees nu- 
meriques, auquel la methode de validation des revendications 1-5 a et6 appliquee, a I'aide de la methode definie 
dans la revendication 6. 

50 10. Des supports nunrteriques pre-enregisttes avec un programme informatique comme defini dans la revendication 
8 ou la revendication 9. 
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